Determining if Data from Electronic Health Record Systems Can Be Trusted in a Clinical Trial Setting

Electronic Health Record (EHR) systems are being used increasingly by clinical investigative sites. This results in a growing expectation, by regulatory agencies, for clinical trial sponsors to verify that EHR systems comply with requirements to protect confidentiality and provide accurate and reliable data for use in a regulated research environment. The U.S. Food and Drug Administration’s (FDA) recent guidance titled “Use of Electronic Health Record Data in Clinical Investigations” (July 2018) encourages modernization and efficiencies in clinical investigation by using new technologies and Electronic Health Records (EHRs) in the clinical trial setting. The guidance recommends the collaboration between clinical trial sponsors and health care organizations towards interoperability and integration of EHRs and electronic data capture (EDC) systems. The legal framework for data protection also covers EHRs; and national legislative provisions or equivalent set of requirements on health data exist, but they are primarily focused on medical care practices and do not always include the use of computerized systems for EHRs. Disparities exist among countries and among investigational sites within countries on the deployment of EHRs for clinical trials. 

The FDA provided recommendations on use of EHRs as a source of data in clinical trials to “ensure there are appropriate security measures employed to protect the confidentiality and integrity of the study data.”¹ In August 2010, guidance from the EMA went into effect that indicated that the EHR systems in use at clinical trial investigative sites must be assessed “to determine how well they meet the requirements of GCP. The assessment should include consideration of the potential harm to trial subjects and patient rights and to the data integrity of the trial. If the systems do not meet the GCP requirements, then mitigating actions should be taken as necessary prior to trial site initiation.”² Regulatory agencies expect EHR systems in use at investigative sites to comply with GCP requirements and are requesting access to the EHR during inspections. The FDA has indicated, “All relevant information in the EHR pertaining to the clinical investigation must be made available to FDA for review upon request.”¹ If data from EHR systems are transmitted or manually transcribed into EDC (or similar) systems to sponsors, it is clear that regulators expect those data from the EHR to be within the scope of their guidance.^{1, 2}

Identifying all global requirements for EHR systems can be a daunting task for investigative sites. To add to the complexity, sponsor companies have varied ways of assessing and documenting an EHR system’s readiness for use in clinical research. The eClinical Forum, a non-commercial global organization with over 45 company members active in regulated clinical research processes and technologies, has been involved since 2006 in the establishment of conformance criteria to allow compliant integration of EHR data in clinical development. Their work resulted in approved functional standards by ANSI/HL7^3,5 and EuroREC⁴ and their eSource Readiness Assessment (eSRA) is a practical way to apply these functional standards in the clinical setting. eSRA enables investigative sites to evaluate and report on regulatory risk when their EHR systems contain source data.  

eSRA is a standardized approach, free of charge, for assessing and documenting the compliance of EHR systems with regulations and guidance documents. This allows research sites, EHR system vendors, and sponsors to determine if data from a healthcare system are appropriate for use as source for clinical research.

eSRA includes questions related to site and system information, handling of records for clinical research, date and time information in the system, access control, data review, backup, retention & recovery, system development and maintenance. The outcome of a site’s self-assessment could be reused across their clinical trial sponsors. If adopted by sponsors, sites could avoid being assessed by multiple sponsors and would receive uniform questions for the evaluation of their EHR system. EHR vendors can add benefit for their customers by providing documentation of their systems’ compliance with the requirements so that sites would only need to assess their office practices and not the vendor’s system(s) functionality. Additionally, the adoption of eSRA standardized approach enables sponsors to decrease site assessment efforts as the site has the possibility to have already completed the self-assessment for each of their systems. If so, the site can re-use evidence of the eSRA documentation, even if completed initially for a different sponsor or clinical trial. 

The eClinical Forum’s eSRA was first introduced as a free standard tool in August 2015. As of March 2018, it had been used by over 1220 sites in 49 countries.  

Feedback on usage of this first version of eSRA, along with updated regulations and guidance, were discussed at length by the eClinical Forum team resulting in the release of an updated eSRA v2018.1 in March 2018. The eSRA (eSource Readiness Assessment) Handbook and Template can now be downloaded via www.eclinicalforum.org/esra. 

Observations and lessons-learned from reviewing the eSRA Version 1 assessments[i]:

· Overall the majority of assessments indicated sites’ systems had a high degree of compliance (>80%) to the subset of questions a system would need to comply, to be recommended for use as the source of data for clinical research (those that are critical based on assessment of regulations and guidance). This subset of questions is designated with * in the current version of the eSRA.

· Many assessments were incomplete, indicating that a sponsor/CRO might not have reviewed the assessment. After completion of the eSRA, the sponsor would need to work with the site to further assess any responses indicating incomplete compliance with the requirement to determine any actions needed by the site in order to ensure the reliability of the data from the EHR to be used in clinical research. 

· Occasionally, sites indicated a workaround was necessary to comply with the requirement; however, the action appeared inadequate or inappropriate to satisfy the requirement. It was unclear how the site was instructed to mitigate the risk and how it was subsequently documented by the sponsor (e.g., a workaround of “unsure” or “ask vendor” is not appropriate as a viable mitigation for compliance to the statements).

· A completed eSRA cannot be used to exonerate sponsors from doing and documenting their risk assessment for sites’ systems. The sponsor must still review the completed eSRA and assert that the system and associated processes, as indicated in the eSRA, are suitable to originate data for their study.

· To complete an eSRA, it is typically necessary to gather information from both the study coordinator and the IT support staff. Because the eSRA is quite comprehensive, completion of the assessment is not an activity that can be completed in haste. Sufficient time should be provided for Site and other Health Care Provider support staff and subcontractors to ensure the accuracy and appropriateness of the eSRA responses. 

There is growing scrutiny of EHR systems used in clinical research evidenced by regulators requesting EHR assessment documentation, such as eSRA. Although EHR systems have been in use for a while in investigative sites, that those systems need to comply with requirements to ensure data integrity and protection of confidentiality when the data contained therein are used in clinical research. Use of eSRA could provide reliable, efficient means for assessing systems accessed for risk-based monitoring and source data verification without imposing on the sites the outdated hurdle of maintaining paper (or other forms of manually transcribed) source records. The standardized assessment approach and documentation of eClinical Forum’s eSRA is a viable mechanism for sites, sponsors and EHR vendors to demonstrate that the EHR system meets requirements for providing trust-worthy data for regulated clinical trials. The use of eSRA is strongly recommended for all sponsors who strive to present a harmonized and efficient compliance assessment in mutual recognition of quality standards. Sponsors, CROs, Sites, Software Vendors, and Regulators can get more information on eSRA from www.eclinicalforum.org/esra.

Suzanne Bishop (eClinical Forum), Cheryl Tucker McClung (Lilly), Yvonne Rollinger (OmniComm), Yiannis Karageorgos (Bristol-Myers Squibb), Kelley Olree (Pfizer), Ludger Bührmann (GSK), Martijn Griep (Johnson & Johnson)

References

1. “Use of Electronic Health Record Data in Clinical Investigations: Guidance for Industry”, U.S. Department of Health and Human Services, Food and Drug Administration (July 2018)

1. “Reflection paper on expectations for electronic source data and data transcribed to electronic data collection tools in clinical trials”, European Medicines Agency, GCP Inspectors Working Group (9 June 2010)

1. HL7 Specifies Functional Requirements for Clinical Research in an EHR-S, November 6, 2009

1. EHR/CR User Requirements Document (Release 1, Feb 24 2008)

1. Practical Considerations for Clinical Trial Sites using Electronic Health Records Certified for Clinical Research, Applied Clinical Trials Jun 30, 2011